The following dependencies should be removed as Paketo-hosted dependencies:
Remove the Paketo-hosted dependency.
The buildpack can use the dependency that is provided by Go which can be parsed from a JSON payload of thier download page with little to no modification. The precedence for this payload page existing can be found in the Go Docs for the website. The payload includes a SHA256 from Go meaning the artifact can be verified from the upstream. Here is a proof of concept PR showing the buildpack using the dependencies directly from the Go upstream. Because this dependency can be consumed from a trusted source, we should stop hosting it ourselves.